1. Field
The disclosure relates generally to data processing systems and information technology and more specifically to event models in an information technology environment in which events are represented by modeled indications.
2. Description of the Related Art
An information model is an abstraction that defines how managed elements in an information technology environment are represented as a set of objects and relationships between them. This abstraction is intended to allow consistent management of data processing system elements independent of their manufacturer or provider. An information model allows multiple parties to exchange information about managed elements. An information model also may provide the ability to actively control and manage such elements. By using a common model of information, management software can be written once and work with many implementations of the model without complex and costly conversion operations or loss of information.
An example of an information model is the Common Information Model (CIM). The Common Information Model is an open standard defined and published by the Distributed Management Task Force (DMTF). A related standard is Web-Based Enterprise Management (WBEM), also defined by DMTF. Web-Based Enterprise Management defines a particular implementation of the Common Information Model, including protocols for discovering and accessing such Common Information Model implementations.
The Common Information Model standard includes an infrastructure specification and a schema. The Common Information Model infrastructure specification defines the architecture and concepts of the model, including a language by which the schema is defined, and a method for mapping the Common Information Model to other information models, such as Simple Network Management Protocol (SNMP). The Common Information Model architecture is based upon Unified Modeling Language (UML), so it is object-oriented. Managed elements are represented in the model as Common Information Model classes. Relationships between elements are represented as Common Information Model associations. Inheritance allows specialization of common base elements into more specific derived elements.
The Common Information Model schema is a conceptual schema which defines the specific set of objects and relationships between them that represent a common base for the managed elements in an information technology environment. The schema covers most elements in an information technology environment, such as computer systems, operating systems, networks, middleware, services, and storage. The schema defines a common basis for representing these managed elements. Since most managed elements have product and vendor specific behavior, the schema is extensible in order to allow the producers of these elements to represent their specific features seamlessly together with the common base functionality defined in the schema.
In an information technology context, an event can be defined as a change in state. For example, when a service is started, its state is changed from “stopped” to “started”. When a plug-and-play device is added to a data processing system, the state of the system hardware configuration is changed. Alternatively, events can be defined as the occurrence of phenomena of interest. For example, an event can denote the occurrence of a disk write error, a failed authentication attempt, or even a mouse click. An event may be a pervasive incident that occurs infrequently, such as a system re-boot. Alternatively, events may reflect very small scale, frequently occurring incidents, like mouse clicks.
The way events are handled can vary. Some events may require immediate action on the part of the observer. For other types of events, the action may be deferred until a later time. For example, an “out of disk space” event on a Web server may require immediate action to make disk space available. An event indicating that an application has exceeded expected processor utilization can be handled as part of nightly billing reconciliation.
The Common Information Model includes an event model that defines event-related abstractions. The event model defines an indication hierarchy and the use of indications to model events. An event is defined to be the occurrence of a phenomenon of interest. Examples of events include: the failure of a hardware device, the exceeding of an acceptable resource utilization threshold, or the successful completion of the installation of a product. An indication, on the other hand, is a record of the detection of an event of interest. There is not necessarily a one-to-one correspondence between events and indications. In particular, zero or more indications can be generated for the same underlying event. Two indications are correlated if they do not represent the same underlying event, but there is a relationship between the events they represent.
The Common Information Model indication hierarchy is used to describe the types of events that can be detected and modeled as indications. An abstract class, CIM_Indication, serves as the base class for all indication classes. It includes an indication identifier, an indication time, and correlated indications. Although indications are not guaranteed to be uniquely identifiable, the indication identifier property can be used for identification. If indication correlations are reported, the indication identifier value should be unique. Indication time describes, to the extent possible, the time of the underlying event. Correlated indications are indications that are correlated with an indication, specified by indication identifier.
Types of indications, representing different types of events, are modeled as CIM_Indication subclasses. These subclasses include:                CIM_InstIndication. Used to report Common Information Model instance life cycle events, that is, change of state events. The types of events include: instance creation, deletion, and modification, method invocation and read access. Types of CIM_InstIndication include: CIM_InstCreation, CIM_InstDeletion, CIM_InstModification, CIM_InstMethodCall and CIM_InstRead.        CIM_ClassIndication. Used to report Common Information Model class definition life cycle events. The types of events include: class creation, deletion and modification. Types of CIM_ClassIndication include: CIM_ClassCreation, CIM_ClassDeletion and CIM_ClassModification.        CIM_ProcessIndication. Used to report the occurrence of a phenomenon of interest. This includes alert or notification type events. Types of CIM_ProcessIndication include: CIM_SNMPTrapindication and CIM_AlertIndication.        
An instance of CIM_Indication represents the occurrence of an event. Typically, indications are very short-lived transient objects used to communicate information from an indication generator to zero or more indication consumers.
A subscription portion of the Common Information Model event schema defines how clients subscribe to receive indications. A client process activates a subscription by creating an instance of CIM_IndicationSubscription that defines the subscription. Instances of the CIM_IndicationSubscription association class are used to register to receive indications. In a subscription, a CIM_IndicationFilter instance describes characteristics of a desired set of indications. A CIM_IndicationHandler instance describes the target destination of the indications and a communication protocol. Thus, an instance of CIM_IndicationSubscription defines an association between a CIM_IndicationFilter instance and a CIM_IndicationHandler instance. Indications are sent only if there is an instance of CIM_IndicationSubscription that requests delivery of the indication. Only an indication that matches the condition defined by the CIM_IndicationFilter instance is dispatched. If dispatched, the indication is dispatched only to the destination defined by the CIM_IndicationHandler instance.
For example, a client interested in a particular event subscribes to a running server on a particular managed system. When the client creates the subscription for the event, it specifies a filter and a handler. The filter defines evaluation criteria for the event. The handler defines the destination to which an indication that satisfies the evaluation criteria will be sent. The destination is known as the listener. The listener may be the client who creates the subscription or may be different. A resource monitor part of the server, or a module that is shipped with the server on a particular system, monitors system resources as requested by the client. Whenever an event of interest is generated, the server evaluates the event to check to see if it meets the requirements imposed by the client. If the requirements are satisfied, a corresponding indication is sent to the listener.